CLAIMS 
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A method of managing events in an event engine including the steps of: 

i. inputting an event into the engine; 

ii. the engine extracting a rule from a rules database wherein identification 
information within the rule identifies the event; 

iii. the engine holding the event for the expiration of a specified interval; 

iv. before the expiration of the specified interval inputting a further event into 
the engine; 

v. the engine identifying the further event using identification information 
within the rule; 

vi. the engine creating and outputting a new event; 

vii. inputting the new event into the engine; and 

viii. the engine extracting a second rule from a rules database wherein 
identification information within the second rule identifies the new event. 

2. A method as claimed in claim 1 wherein the event and the further event originate 
from any of the set of a network, an application, an operating system, and 
hardware. 

3. A method as claimed in claim 2 wherein the event and the further event and 
received from one or more intelligent agents. 

4. A method as claimed in claim 3 wherein the event is in a standard format. 

5. A method as claimed in claim 4 wherein the identification information includes: 

i. an attribute; 

ii. an operator; and 

iii. a value. 

6. A method as claimed in claim 5 wherein the specified interval is time. 

7. A method of managing events in an event engine including the steps of: 

i. inputting an event into the engine; 

ii. the engine extracting a rule from a rules database wherein identification 
information within the rule identifies the event; 
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iii. the engine creating and outputting a new event; 

iv. inputting the new event into the engine; 

v. the engine extracting a second rule from the rules database wherein 
identification information within the second rule identifies the new event; 

vi. the engine holding the new event for the expiration of a specified interval; 

vii. before the expiration of the specified interval inputting a further event into 
the engine; 

viii. the engine identifying the further event using identification information 
within the second rule; and 

ix. the engine creating and outputting a further new event. 

A method as claimed in claim 7 wherein the event and the further event originate 
from any of the set of a network, an application, an operating system, and 
hardware. 

A method as claimed in claim 8 wherein the event and the further event and 
received from one or more intelligent agents. 

A method as claimed in claim 9 wherein the event is in a standard format. 

A method as claimed in claim 10 wherein the identification information includes: 

i. an attribute; 

ii. an operator; and 

iii. a value. 

A method as claimed in claim 1 1 wherein the specified interval is time. 

A method a claimed in claim 12 wherein the outputted further event is received by 
a user console. 

A method of managing events in an event engine including the steps of: 

i. inputting an event into the engine 

ii. the engine extracting a first rule from a rules database wherein 
identification information within the first rule identifies the event; 

iii. the engine holding the event for the expiration of a specified interval; 
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iv. before the expiration of the specified interval inputting a further event into 
the event engine; 

v. the engine extracting a second rule from the rules database wherein 
identification information within the second rule identifies the further event; 

vi. the engine creating and outputting a new event; 

vii. before the expiration of the spiecified interval inputting the new event into 
the engine; 

viii. the engine identifying the new event using identification information within 
the first rule; and 

ix. the engine creating and outputting a further new event. 

A method as claimed in claim 14 wherein the es/ent and the further event originate 
from any of the set of a network, an application, an operating system, and 
hardware. 

A method as claimed in claim 15 wherein the event and the further event and 
received from one or more intelligent agents. 

A method as claimed in claim 16 wherein the event is in a standard format. 

A method as claimed in claim 17 wherein the identification information includes: 
j. an attribute; 

ii. an operator; and 

iii. a value. 

A method as claimed in claim 18 wherein the specified interval is time. 

A method a claimed in claim 19 wherein the outputted further event is received by 
a user console. 

A method of managing events including the steps of: 

i. receiving an event; 

ii. extracting a rule from a rules database wherein identification information 
within the rule identifies the event; 

iii. when specified within the rule performing one of: 
a) creating a new event; or 
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b) holding the event; 

wherein during the method at least one rule specifies performance of 
step (a) and at least one rule specifies performance of step (b); and 
iv. repeating steps (i) to (iii) at least once; 

wherein at least one received event in step i. is a new event created in step 

(iii) (a). 

A method of generating an event in an event engine based upon two or more 
received events and an event previously generated by the event engine wherein at 
least one of the events is held by the event engine until the expiration of a 
specified interval. 

A method of managing events including the steps of: 

i. processing an event by: 

a) receiving the event; 

b) extracting one or more rules which match the event from a rules 
database; 

c) discarding the event if at least one of the rules specifies that the event 
is to be discarded; 

d) holding the event if at least one of the rules specifies that the event is to 
be held for a period of time; 

e) altering the event or creating a new event if at least one of the rules 
specifies that the event is to be altered or a new event created; and 

f) outputting the event if all rules specify that the event is to be outputted; 
wherein if the event is discarded then neither of steps (d) and (e) will 
proceed; 

ii. holding the event for the longest period of time specified by the rules if the 
event is specified to be held; and 

iii. repeating step (i) if the event was held in step (ii). 

A system for managing events including: 

i. a plurality of event agents adapted to receive data from a source, to create 
an event from the data and to transmit the event to a central event system; 
and 

ii. a central event system including: 
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a) a rules database adapted to store a plurality of rules, each rule 
including: 

I. identification information specifying to which events the rule 
relates; and 

II. an action wherein the action is one of outputting the event, 
discarding the event, holding the event, or creating a new event; 

wherein, where the action is holding the event the rule further 
includes: 
L a condition; and 

II. a further action wherein the further action is one of outputting the 
event, discarding the event, holding the event, creating a new 
event, or creating a new event and transmitting the new event 
back into the processing engine; and 

b) a processing engine adapted to receive events, to extract rules from the 
rules database, to identify which rules apply to the events using the 
identification information within the rule, to perform the action specified 
within the applicable rules, and to perform the further action specified 
within the applicable rules when the corresponding condition is 
satisfied. 

A system as claimed in claim 24 including one or more user consoles adapted to 
receive one or more of the events outputted by the central event system. 

A system as claimed in claim 25 wherein the source is any one of the set of a 
database, an application, an operating system, and hardware. 

A system as claimed in claim 26 wherein the identification information includes: 

i. an attribute; 

ii. an operator; and 

iii. a value. 

A computer system for effecting the method of claim 21 . 

Software for effecting the method of claim 21 . 

Storage media containing software as claimed in claim 29. 
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31 . Software for effecting the system of claim 24. 

32. Storage media containing software as claimed in claim 31 
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